npm - koa-classic-server - Versions diffs - 4.2.0 → 4.2.1 - Mend

koa-classic-server 4.2.0 → 4.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/index.cjs +19 -17
package/package.json +1 -1

package/index.cjs CHANGED Viewed

@@ -2042,8 +2042,11 @@ module.exports = function koaClassicServer(
                         }
                     }
-                    // No index file found, show directory listing
-                    ctx.body = await show_dir(toOpen, ctx);
+                    // No index file found, show directory listing. On a readdir
+                    // failure show_dir writes the 500 error page itself and returns
+                    // undefined — don't clobber that body with the listing assignment.
+                    const listing = await show_dir(toOpen, ctx);
+                    if (listing !== undefined) ctx.body = listing;
                 } else {
                     // Directory listing disabled
                     await sendErrorPage(ctx, 404);
@@ -2534,21 +2537,13 @@ module.exports = function koaClassicServer(
                 }
             } catch (error) {
                 _logger.error('Directory read error:', error);
-                ctx.status = 500;
-                setGeneratedPageHeaders(ctx, NOT_FOUND_CSP);
-                return `
-                    <!DOCTYPE html>
-                    <html>
-                    <head>
-                        <meta charset="UTF-8">
-                        <title>Error</title>
-                    </head>
-                    <body>
-                        <h1>Error Reading Directory</h1>
-                        <p>Unable to access directory contents.</p>
-                    </body>
-                    </html>
-                `;
+                // Route through the unified writer so this 500 honors errorPages[500]
+                // (custom page when configured), the no-store / header-scrub, and the
+                // generated-page security headers — like every other 500. sendErrorPage
+                // sets ctx.status/headers/body itself; returning undefined signals the
+                // caller not to overwrite the body it just wrote.
+                await sendErrorPage(ctx, 500);
+                return undefined;
             }
             // Relative path of this directory from rootDir (used for alwaysHide path matching)
@@ -2868,4 +2863,11 @@ module.exports._internals = {
     singleFlight,
     refreshOrInsert,
     escapeHtml,
+    // writeErrorPage is the shared output path for every middleware-generated error
+    // response (sendErrorPage / sendErrorPageSync delegate to it). Exposed so its
+    // contract — header scrub, no-store on >=500, Content-Type, custom-vs-built-in
+    // body, CSP only for the built-in page — can be asserted deterministically: the
+    // stream-failure branches that also use it can't be, because Koa 3 tears the
+    // socket down on a mid-stream body error before the client sees the response.
+    writeErrorPage,
 };

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "koa-classic-server",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "description": "High-performance Koa middleware for serving static files with classic directory listing (similar, but not identical, to Apache 2), HTTP caching, template engine support, and comprehensive security fixes",
   "main": "index.cjs",
   "exports": {